Hi Jacked From the Ukraine

Welcome to Majorgeeks!

You have a Wareout infection and need to follow our standard cleaning procedure first. Then we will be able to work on Wareout. Note that no logs should be posted inline. They must be attachments to your messages.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

.

 

Please follow directions. You have not run all steps in the READ ME yet. Read step 6 again. You have not run it and have not attached the logs. from it. Also step 7 of the READ ME clearly states (and I mentioned this in my last message), DO NOT post logs in line. The must be attachments to messages.

Complete the rest of the READ ME and attach the two requested logs. The proceed to the below:

Look in Add/Remove programs for UnSpyPC and uninstall if found.

Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

• Save it to your desktop and then run it by double clicking on it. It creates a folder named c:\fixwareout.
• Click Next, then Install.
• Then make sure Run fixit is checked (this runs C:\fixwareout\fixit.bat). And then click Finish.
• The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so.
• Your system may take longer than usual to load; this is normal.
• When your system reboots, follow the prompts. Afterwards, HijackThis will launch. Please click Scan, and check the following items if they still exist:

O17 - HKLM\System\CCS\Services\Tcpip\..\{455017F6-EE8E-49B0-9879-9B97139B5155}: NameServer = 85.255.116.162 85.255.112.196
O17 - HKLM\System\CS1\Services\Tcpip\..\{455017F6-EE8E-49B0-9879-9B97139B5155}: NameServer = 85.255.116.162 85.255.112.196

After clicking Fix Checked, close HijackThis, and click OK to proceed.

At the end of the fix, reboot into safe mode and use Windows Explorer to double check for the below files and delete if found:
C:\Program Files\UnSpyPC <--- delete the whole folder if found


Now reboot into normal mode and please attach the contents of the logfile C:\fixwareout\report.txt

Also attach a new HijackThis log.